Effective 2026-08-18. Last updated 2026-08-26.
This Privacy Policy explains how Zagaza Labs Inc. ("Zagaza," "we," "us," or "our") collects, uses, discloses, retains, and safeguards personal information when you use the Lumina mobile applications, website, support channels, and related services (collectively, "Lumina" or the "Service").
By creating an account or using Lumina, you acknowledge this Policy. Where applicable law requires consent, we will ask for it at or before collection, including through system permission prompts for Apple Health, Health Connect, photos, microphone access, and notifications.
Zagaza Labs Inc., an Ontario corporation, is responsible for personal information under its control. Zagaza's Privacy Officer oversees compliance and can be reached using the details in section 16.
This Policy applies to information handled by Zagaza through Lumina. It does not govern the independent practices of Apple, Google, wearable manufacturers, app stores, or other third parties whose services you choose to use. Their policies apply to information they control.
"Personal information" means information about an identifiable individual, as defined by applicable law. It includes information that can identify you directly and information that can reasonably be linked to you. Aggregated or irreversibly anonymized information that cannot identify an individual is not personal information.
We limit collection to information reasonably needed for the purposes in this Policy.
If you expressly permit it, Lumina may read selected information from Apple Health on iOS or Health Connect on Android, such as:
The permission screen on your device is the authoritative list of data types requested in the version you use. Lumina accesses only the categories you approve. You can use Lumina without connecting Apple Health or Health Connect, although some features may be less personalized.
We do not intentionally collect precise geolocation. An IP address can reveal an approximate region, even when we do not use it to track your location.
We collect personal information:
We use personal information to:
We may allow a limited number of authorized personnel to review the minimum account content reasonably needed to address a support request, investigate a security or abuse issue, diagnose a technical failure, or evaluate a specific safety or quality problem. Access is restricted and logged or otherwise controlled where appropriate.
We do not use identifiable health or account content to train an external provider's general-purpose AI models. If we propose to use identifiable personal information for a materially different research or model-training purpose, we will explain that purpose and obtain express consent where required.
We seek meaningful consent based on the sensitivity of the information and the purpose. Some collection and use are necessary to provide Lumina. Optional features, such as connected health data, microphone, photos, and notifications, use separate device permissions where available.
You may withdraw consent, subject to legal or contractual restrictions and reasonable notice:
Withdrawing consent does not affect processing already lawfully completed. If required information is withdrawn, some features may stop working or we may be unable to provide the Service.
Lumina uses formulas, algorithms, and third-party AI systems to interpret inputs and generate content such as meal estimates, plans, summaries, and coach responses. Relevant portions of your profile, logs, connected data, messages, images, or audio may be sent to providers when needed to perform the feature you request.
Lumina's automation personalizes general fitness and wellness content. It is not used to make decisions that create legal, employment, insurance, credit, healthcare-access, or similarly significant effects about you. If that changes, we will provide any explanation, notice, and rights required by law before the new processing begins.
AI output may be wrong. The Terms of Service explain important limits and safety precautions.
We do not sell or rent personal information and do not disclose it to data brokers or advertisers. We may disclose or transfer the minimum personal information reasonably necessary to the following categories of recipients:
These organizations process information for the purposes described in this Policy. We use contractual and other measures designed to require appropriate confidentiality, security, purpose limitations, and retention practices. Zagaza remains accountable for personal information transferred to a provider for processing as required by applicable Canadian law.
We may disclose information if we reasonably believe disclosure is permitted or required to comply with law, a court order, lawful government request, or legal process; protect rights, safety, and security; investigate fraud or abuse; enforce our Terms; or establish, exercise, or defend legal claims. We review requests and disclose only what we reasonably believe is required.
We may disclose information in connection with due diligence, financing, reorganization, merger, acquisition, or sale of all or part of Zagaza or its assets. We will use appropriate confidentiality protections and require the recipient to handle personal information consistently with applicable law. If control of personal information changes, we will provide notice where required.
We may disclose information when you direct us to do so or give express consent.
Information obtained through Apple Health or Health Connect is used only to provide and improve health and fitness features visible to you, such as weight trends, activity context, recovery context, expenditure estimates, and personalized plans or coaching.
We do not use this information for targeted advertising, sell it, disclose it to data brokers, or use it to determine eligibility for credit, employment, insurance, housing, or healthcare. We do not combine it with advertising profiles. We request only the permissions reasonably needed for current features.
You can revoke access at any time through Apple Health, iOS Settings, or Health Connect. Revocation stops future collection from that source. It does not automatically delete information already imported into Lumina. You can delete records in Lumina where that control is available or delete your account.
Zagaza is based in Canada, but personal information may be stored or processed in other provinces or countries, including the United States, where our providers or their subprocessors operate. The laws of those places may permit courts, law-enforcement agencies, national-security authorities, or regulators to access information in circumstances that differ from Canadian law.
Before using providers, we assess relevant privacy and security factors and use contractual or other safeguards designed to provide a comparable level of protection while information is processed. No contractual measure can override a valid law in the country where information is processed.
Contact the Privacy Officer if you want more information about processing locations or our use of service providers.
We retain personal information only as long as reasonably necessary for the purposes described in this Policy, to provide the Service, and to satisfy legal, accounting, security, fraud-prevention, dispute, and enforcement needs. Retention depends on the type and sensitivity of information and the reason it is held.
In general:
When you delete your account, we delete or de-identify personal information associated with the account from active systems within a reasonable processing period. Limited information may be retained where required or permitted for legal compliance, transaction records, fraud prevention, security, dispute resolution, or enforcement. Residual copies may remain temporarily in encrypted or access-restricted backups and are deleted or overwritten under normal backup schedules. Our providers may also retain limited copies for the same purposes or under their normal secure backup cycles.
Deleting your account does not cancel an Apple App Store or Google Play subscription. Cancel the subscription separately through the store used to purchase it. You can delete your account in the app or through the account-deletion page.
We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information. Measures include encryption in transit and at rest, access controls, secure device credential storage, provider review, monitoring, and practices intended to minimize personal information in diagnostics and notifications.
No method of storage or transmission is completely secure. We cannot guarantee that a breach, loss, or unauthorized access will never occur. If a privacy incident creates a risk that requires notice or reporting under applicable law, we will notify affected individuals and regulators as required.
You are responsible for securing your device, email account, Apple or Google account, and device passcode. Contact support@joinlumina.app promptly if you suspect unauthorized access to your Lumina account.
Subject to applicable law and limited exceptions, you may ask us to:
You can access and change some information directly in Lumina. You may request an account export through available in-app controls or by contacting the Privacy Officer.
We may need to verify your identity before completing a request. We will respond within the period required by applicable law. In limited cases, the law may permit or require us to refuse access, withhold another person's information, retain a record, or charge a permitted fee. If so, we will explain the decision and available recourse unless prohibited by law.
For Quebec residents, applicable rights may also include requesting cessation of dissemination or de-indexation in qualifying circumstances. Quebec privacy requests are generally answered within 30 days as required by applicable law.
Lumina is intended only for adults aged 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account or provided information, contact privacy@zagaza.app. We will investigate and delete the information where appropriate.
The Lumina app and website do not use advertising trackers or cross-site behavioural advertising. The website may use essential local storage, cookies, or similar technology if needed for security, basic functionality, or preference storage. Servers may automatically create standard access and security logs, including IP address, timestamp, request, and response information.
If we introduce non-essential analytics, advertising technology, or a materially different use of cookies, we will update this Policy and provide any notice or consent control required by law before the change applies.
We may update this Policy as Lumina, our providers, or legal requirements change. We will post the revised Policy and update the effective date. If a change is material, we will provide reasonable advance notice in the app, by email, or through another appropriate method and obtain consent where required.
We will not materially expand how we use previously collected sensitive personal information without additional notice or consent where required by law.
Questions, requests, or complaints may be directed to:
Privacy Officer
Zagaza Labs Inc.
Toronto, Ontario, Canada
Email: privacy@zagaza.app
Please include enough information for us to understand the request, but do not send passwords, full payment-card details, or unnecessary health information by email.
We will investigate and respond to privacy complaints. If you are not satisfied, you may have the right to contact the Office of the Privacy Commissioner of Canada or, if applicable, a provincial privacy regulator such as the Commission d'accès à l'information du Québec.
Lumina's food database is built from public and openly licensed sources. It is reference data about foods, not information about you, and nothing in it is derived from your account.
Macro estimates shown for a food come from these sources or are estimated by Lumina, and are approximations rather than measured values.